diff --git a/conf/autoload_configs/httapi.conf.xml b/conf/autoload_configs/httapi.conf.xml
index dfd7d692fb..c2fe584a02 100644
--- a/conf/autoload_configs/httapi.conf.xml
+++ b/conf/autoload_configs/httapi.conf.xml
@@ -26,7 +26,26 @@
 	<!-- <permission name="all" value="true"/> -->
 	<!--<permission name="none" value="true"/> -->
 	<permission name="set-params" value="true"/>
-	<permission name="set-vars" value="false"/>
+	<permission name="set-vars" value="false">
+	  <!-- default to "deny" or "allow" -->
+	  <!-- type attr can be "deny" or "allow" nothing defaults to opposite of the list default so allow in this case -->
+	  <!-- 
+	  <variable-list default="deny">
+	    <variable name="caller_id_name"/>
+	    <variable name="hangup"/> 
+	  </variable-list>
+	  -->
+	</permission>
+	<permission name="get-vars" value="false">
+	  <!-- default to "deny" or "allow" -->
+	  <!-- type attr can be "deny" or "allow" nothing defaults to opposite of the list default so allow in this case -->
+	  <!-- 
+	  <variable-list default="deny">
+	    <variable name="caller_id_name"/>
+	    <variable name="hangup"/> 
+	  </variable-list>
+	  -->
+	</permission>
 	<permission name="extended-data" value="false"/>
 	<permission name="execute-apps" value="true">
 	  <!-- default to "deny" or "allow" -->
@@ -36,7 +55,21 @@
 	    <application name="hangup"/>
 	  </application-list>
 	</permission>
-	<permission name="expand-vars-in-tag-body" value="false"/>
+	<permission name="expand-vars-in-tag-body" value="false">
+	  <!-- default to "deny" or "allow" -->
+	  <!-- type attr can be "deny" or "allow" nothing defaults to opposite of the list default so allow in this case -->
+	  <!-- 
+	  <variable-list default="deny">
+	    <variable name="caller_id_name"/>
+	    <variable name="hangup"/> 
+	  </variable-list>
+
+	  <api-list default="deny">
+	    <api name="expr"/>
+	    <api name="lua"/> 
+	  </api-list>
+	  -->
+	</permission>
 	<permission name="dial" value="true"/>
 	<permission name="dial-set-context" value="false"/>
 	<permission name="dial-set-dialplan" value="false"/>
diff --git a/src/mod/applications/mod_httapi/mod_httapi.c b/src/mod/applications/mod_httapi/mod_httapi.c
index 5449cb5e0d..42a05e3262 100644
--- a/src/mod/applications/mod_httapi/mod_httapi.c
+++ b/src/mod/applications/mod_httapi/mod_httapi.c
@@ -999,7 +999,7 @@ static switch_status_t parse_xml(client_t *client)
 							}
 							switch_event_add_header_string(client->params, SWITCH_STACK_BOTTOM, tag->name, val);
 						}
-						tag = tag->sibling;
+						tag = tag->ordered;
 					}
 				}
 			}
@@ -1014,6 +1014,8 @@ static switch_status_t parse_xml(client_t *client)
 							if (zstr(val)) {
 								val = NULL;
 							}
+							printf("WTF [%s][%s]\n", tag->name, val);
+
 							if (client->profile->perms.set_vars && 
 								(!client->profile->var_params.set_var_list || 
 								 switch_event_check_permission_list(client->profile->var_params.set_var_list, tag->name))) {
@@ -1022,7 +1024,7 @@ static switch_status_t parse_xml(client_t *client)
 								switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "variable %s permission denied!\n", tag->name);
 							}
 						}
-						tag = tag->sibling;
+						tag = tag->ordered;
 					}
 				}
 			}
diff --git a/src/mod/applications/mod_httapi/mod_httapi_doc.txt b/src/mod/applications/mod_httapi/mod_httapi_doc.txt
index c8121379bc..cb5463dca4 100644
--- a/src/mod/applications/mod_httapi/mod_httapi_doc.txt
+++ b/src/mod/applications/mod_httapi/mod_httapi_doc.txt
@@ -18,10 +18,10 @@ The format is roughly as described below (We could use a DTD maybe).
 
 <document type="xml/freeswitch-httapi">
   <params>
-    <param name="" value=""/>
+   <someparam>someval</someparam>
   </params>
   <variables>
-    <variable name="" value=""/>
+   <somevar>someval</somevar>
   </variables>
   <work>
   <...>